Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
CashCowCoin$117K
A flaw in CashCowCoin’s router let repeated sells burn tokens from the trading pool while leaving its reduced WBNB reserves unchanged. The attacker used this mismatch to drain WBNB from the pool over about 80 cycles.
CCCTokenBSC$117K
A flaw in CCC’s sell function let an attacker burn CCC held by the PancakeSwap pool and reset its reserves, distorting the token’s price. The attacker repeatedly sold CCC to extract BNB from the pool.
Amnext$116K
An attacker exploited Amnext’s lottery and prize-pool protocol by mass-minting AMC tickets, then drained about 154 WBNB through PancakeSwap, causing losses of roughly $116,100.
GoldPesaDeFi ProtocolBase$115K
A flaw in GoldPesa’s liquidity rebalancing let an attacker’s unpaid position draw on the protocol’s USDC credit in a shared Uniswap pool manager. The attacker withdrew about 114,900 USDC; Uniswap v4 itself was not compromised.
InsurancePool/CoreVault$112K
An attacker used a flash loan—a loan borrowed and repaid within one transaction—to manipulate prices used by CoreVault. This inflated a redemption and let the attacker extract excess funds from InsurancePool.
DIPTokenBSC$111K
A missing return statement in the DIP token’s transfer function caused PancakeSwap trades to execute twice. The attacker manipulated the pool’s reserves and drained about $111,000 in USDC.
Ambient FinanceDeFi ProtocolEthereum$111K
An accounting flaw in Ambient Finance’s deposit and withdrawal logic let an attacker cycle funds through the protocol’s contract and withdraw about 83.72 ETH.
MAP ProtocolChainBridgeEthereumBSC$110K
A flaw in Butter Bridge’s retry-message checks let an attacker mint unauthorized MAPO tokens on Ethereum and BNB Chain. They extracted about 52.2 ETH in value before MAPO’s price crashed.
MetaSeaDeFi ProtocolArbitrum$110K
MetaSea’s redemption function overpaid SEA yield when positions were opened and redeemed in the same block. Using flash loans, the attacker repeatedly deposited USDT, claimed and sold excess SEA, and extracted about $110,000 across eight attacks.
RWC Token$109K
An attacker used a flash loan and an unprotected burn function to destroy RWC tokens in a BNB Chain trading pool and manipulate its reserves before selling. The pool lost about 109,461 USDT; fee logic routed some funds to project wallets, and the attacker kept about 39,964 USDT.
NovaBoxChainEthereum$107K
NovaBox’s reward system calculated dividends before updating deposit balances, letting the attacker claim rewards based on inflated holdings. Using a flash loan, the attacker drained nearly all of the reward pool through these fake dividends.
Thetanuts FinanceDeFi ProtocolEthereum$105K
A rounding flaw in a deprecated vault let the attacker repeatedly mint shares while the required deposits rounded to zero, then redeem the vault’s assets. A whitehat later used the same flaw to recover most of the funds, leaving a reported net loss of about $105,000.
Secured FinanceDeFi ProtocolEthereum$104K
Attackers used flash-loaned funds to make self-trades that distorted Secured Finance’s order-book price, then used the falsely valued lending position as collateral to withdraw assets. The protocol estimated losses at about $180,000; recovery was unconfirmed.
Huma FinanceDeFi ProtocolPolygon$101K
A logic and access-control flaw in Huma Finance’s deprecated V1 credit pools let an attacker advance unapproved credit records and borrow the pools’ remaining funds. About 101,400 USDC and USDC.e was taken from protocol and pool-owner fees; user funds were not at risk.
ZerionWallet$100K
An attacker used social engineering to compromise a Zerion employee’s device and obtain access to internal hot-wallet keys. About $100,000 was taken from company wallets; user funds and Zerion’s products were unaffected.
PGNLZDeFi ProtocolBSC$100K
A flaw in PGNLZ’s burn mechanism let the attacker reduce the tokens recorded in a PancakeSwap pool without properly updating its reserves. The resulting price distortions enabled reverse swaps that siphoned about $100,000 in USDT from the pool.
ONTRTokenEthereum$98.2K
A flawed ownership check let anyone reclaim control of ONTR after its creator renounced ownership. The attacker used hidden balance-grant logic to create a large apparent ONTR balance, sold it into the token pool, and took out WETH.
FlashTradeDeFi ProtocolSolana$98K
A flaw in MagicBlock’s SDK failed to check an account during a withdrawal callback, letting an attacker trigger a fake withdrawal from FlashTrade’s Solana ephemeral instance. About $98,000 was taken; the team said it would cover the loss.
IEXCBPDeFi ProtocolBNB Chain$97K
An attacker manipulated PancakeSwap’s live token prices while using flash loans and multiple accounts to exploit IEXCBP’s reward-withdrawal calculations. The protocol’s entire reward pool was drained.
PRXVTDeFi ProtocolBase$97K
An attacker used many generated addresses to bypass per-address limits in PRXVT’s staking contract and claim rewards, draining about 32.8 ETH from the protocol.
warp.greenDeFi ProtocolBridgeChiaEthereum$93K
A flaw in warp.green’s Chia-side bridge module let the attacker pass off worthless tokens as burned wUSDC and drain about $93,000 in USDC-denominated assets from bridge contracts on Base and Ethereum. The attacker converted the funds to ETH.
MCN Labs$92.6K
An inconsistency in MCN Labs’ LP reward accounting let the attacker claim rewards calculated using a higher token reserve than the one used to accrue them. A newly registered liquidity position claimed excess FIST, causing about $92,600 in losses.
Full SailDeFi ProtocolSui$91K
False Switchboard oracle prices distorted Full Sail vault valuations, allowing an attacker to deposit at an artificially low value and withdraw more than they put in. How the false prices bypassed the vault’s safeguards has not been disclosed.
Stake DAODeFi ProtocolBridgeArbitrum$91K
A compromised deployer key let an attacker change Stake DAO’s LayerZero bridge settings and mint trillions of unbacked vsdCRV tokens. They drained about 43.8 ETH from a Curve pool before bridging it; the protocol’s core contracts were not affected.
PacaSwap DEXDeFi ProtocolConstellation$90.8K returned$90.8K
A flaw in Tessellation’s fee accounting let the attacker create SWAP tokens without deposits by triggering an arithmetic underflow. They sold the unbacked tokens into PacaSwap’s SWAP/DAG pool, taking about 12.1 million DAG from liquidity providers.
WAX Multi-Chain BridgeDeFi ProtocolBridgeSolanaEthereumWAX$90.5K
A WAX bridge contract accepted a negative withdrawal fee, letting an attacker trigger full withdrawals without debiting their account. The resulting records caused the bridge to release stablecoins on Solana and Ethereum, costing about $90,500; bridge processing was paused.
PHXTokenBSC$89.5K
PHX’s transfer-fee logic made the liquidity pool’s recorded reserves differ from its actual token balances. The attacker exploited the mismatch, using a flash loan to drain WBNB from the pool.
BYToken$87.4K
An attacker used BYToken’s public auto-burn function to burn tokens directly from its trading pair and reset the pool’s reserves. This skewed the BY/WBNB price, allowing the attacker to sell BY and drain nearly all the pool’s WBNB.
UNCX Network V2DeFi ProtocolEthereumBaseBSC+1 chains$86K
A flaw in UNCX vesting contracts let an attacker manipulate pooled-token accounting through vesting releases, donations, and cancellations, then withdraw tokens belonging to other users. The project reported about $807,000–$808,000 extracted, with roughly $58,000 recovered by whitehats.
CheckoutPoolDeFi ProtocolPolygon$85.7K
CheckoutPool’s unprotected bridge function on Polygon let attackers redirect settlement to accounts they controlled and drain funds.
MoneyMon$85.5K
A signature-checking flaw in MoneyMon’s NFT contract let an attacker bypass reward-claim checks by setting the admin address to zero and using an invalid signature. The attacker drained the contract’s tokens and swapped them for USDT.
BeatXswapDeFi ProtocolBSC$77.5K
BeatXswap’s liquidity contracts priced BTX using a live pool price that could be manipulated. After flash-borrowing and dumping BTX to move that price, the attacker used deposits to extract about 2.98 million BTX, worth roughly $77,500.
KipseliDeFi ProtocolBase$72.4K
Kipseli’s router used a USDC quote as the transfer amount for another token without checking that the tokens matched. An attacker exploited the decimal mismatch to receive far more cbBTC than the WETH they swapped; most of the funds were later returned.
SmartCreditDeFi ProtocolEthereum$72K
SmartCredit’s Leveraged Lido staking feature was exploited, draining funds from the module. The team paused the feature and said its Loss Provision Fund would cover affected stakers’ losses.
Dream Health ChainDeFi ProtocolBSC$71.8K
A flaw in Dream Health Chain’s reward logic let an attacker reset already-claimed awards with a tiny or zero-effective deposit and claim each fixed payout repeatedly. The attacker drained the contract’s shared balance and sold DHC tokens.
Wise Lending V2DeFi ProtocolArbitrumEthereum$66K
A flash-loan attack exploited logic flaws in Wise Lending V2’s Ethereum and Arbitrum deployments, draining about $66,000 from its pools.
FlyCowTokenBSC$65.3K
FlyCow’s FCOW token burned its balance in a liquidity pool during a swap and reset the pool’s reserves, letting an attacker manipulate its state and drain about $65,300 in USDT through another swap.
Custom sAVAX Aave Rebalancer contract$64K
A public function in a custom Aave rebalancer let callers send arbitrary instructions while the contract held borrowing permission for a user. An attacker used it to borrow against that permission and take WAVAX, but a whitehat bot recovered all funds before they could be withdrawn.
Custom sAVAX RebalancerDeFi ProtocolAvalanche$64K
A public function in an Avalanche rebalancer allowed unchecked calls to other contracts. The attacker used its delegated borrowing power from Aave V3 to borrow WAVAX on behalf of victims and extract about $64,000.
OLY$63.4K
A sandwich attack on BSC targeted OLY trades, placing transactions around a victim’s trade to profit from the resulting price movement. Estimated losses were about $63,400.
